Privacy Policy of the DemystifAI.blog Service

§ 1

General provisions

1. This Privacy Policy (hereinafter: the "Policy") contains information on the processing of your personal data in connection with the use of the website operated at https://demystifai.blog (hereinafter: the "Website").
2. Use of the Website is voluntary. The provision of personal data within the scope required by a specific functionality (e.g. newsletter subscription, meeting booking) is voluntary; however, failure to provide such data makes it impossible to use that functionality.
3. The Website contains links to other websites, e.g. https://demystifai.xyz, Substack, LinkedIn, X, GitHub and the easy.tools payment page. Once you go to such a website, its operator processes your data under its own privacy policy.

§ 2

Personal Data Controller

1. The Controller of your personal data is Tomasz Guściora conducting business activity under the name DemystifAI Tomasz Guściora, registered in the Central Register and Information on Business Activity (CEIDG), with its registered office at Górczewska 90A/38 st, 01-117 Warsaw, Poland, tax ID: PL5222887609, REGON: 142537402 (hereinafter: the "Controller").
2. In all matters related to the processing of personal data, you may contact the Controller via e-mail: [email protected], telephone: +48 508 830 667, or by traditional mail sent to the registered office address of the Controller.
3. The Controller has not appointed a Data Protection Officer, as it is not obliged to do so under Article 37 of the GDPR. All data protection matters should be addressed directly to the Controller.

§ 3

Personal data protection measures

1. The Controller applies modern organizational and technical safeguards to ensure an appropriate level of protection of your personal data, in particular: encryption of the connection to the Website (TLS/HTTPS), restriction of access to data to authorized persons only and regular updates of server software.
2. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the "GDPR"), the Polish Act of 10 May 2018 on the protection of personal data, and other provisions on the protection of personal data.

§ 4

Purposes and legal bases of processing

Handling of meeting bookings via Google Calendar

1. Scope of data: first name and surname, e-mail address, optionally time zone and additional information you provide in the booking form.
2. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into an agreement) and Art. 6(1)(f) GDPR (legitimate interest of the Controller in handling contact with a potential customer).
3. Nature of provision: voluntary but necessary to make a booking.
4. Retention period: until the end of the conversation or conclusion of the agreement, and after its conclusion - until claims arising from that agreement become time-barred.

Recording and transcription of consultation meetings (Fireflies.ai)

1. Scope of data: audio/video recording of the meeting, transcription of statements, first name and surname of participants visible in Google Meet, meeting metadata (date, time, duration).
2. Purpose: producing notes, transcripts and summaries of the consultation in order to properly perform the service and to document outcomes.
3. Limited scope: only meetings scheduled in advance through the Google Calendar booking page linked from the Website are recorded. Ad-hoc meetings and phone calls are not recorded.
4. Legal basis: Art. 6(1)(a) GDPR (consent to recording given by participants at the beginning of the meeting) and Art. 6(1)(f) GDPR (legitimate interest of the Controller in documenting consultation outcomes, after consent has been obtained).
5. Nature of provision: voluntary; refusal of consent means that the Fireflies bot will not be admitted to the meeting or will be removed - the meeting will still take place without recording.
6. Retention period: recordings and transcripts are kept for the period necessary to achieve the purpose, no longer than 12 months from the date of the meeting, unless a longer period is necessary to establish, exercise or defend against claims.

Handling of inquiries sent by e-mail

1. Scope of data: e-mail address, first name and other data contained in the message sent to the Controller.
2. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller in responding to the inquiry received).
3. Nature of provision: voluntary but necessary to receive a response.
4. Retention period: until the end of the correspondence or, in the event of an objection, promptly after it is effectively raised.

Sending the newsletter with materials on AI and Claude Code and information about the Controller's training and services

1. Scope of data: e-mail address, selected language and the page of the Website on which you subscribed.
2. Legal basis: Art. 6(1)(a) GDPR (consent given by subscribing via the form and confirmed by clicking the link sent to the e-mail address provided).
3. Nature of provision: voluntary but necessary to receive the newsletter.
4. Retention period: until you unsubscribe or withdraw consent. You can do so at any time via the link in every message or by writing to [email protected].

Exercising GDPR rights and fulfilling data protection obligations

1. Scope of data: first name and surname, contact details provided by the data subject.
2. Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation to which the Controller is subject under provisions on the protection of personal data).
3. Nature of provision: necessary to properly exercise the rights granted by the GDPR.
4. Retention period: until the expiry of the limitation periods for claims arising from violations of data protection law.

Administration of the Website (server logs and security)

1. Scope of data: IP address, date and time of the request to the server, information about the browser and operating system. This data is recorded automatically in server logs and in Cloudflare logs.
2. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller in ensuring the proper and secure operation of the Website).
3. Nature of provision: no active provision of data is required - the data is collected automatically as you use the Website.
4. Retention period: until an objection is effectively raised or the purpose of processing is achieved, but no longer than 12 months for standard access logs.

§ 5

Profiling for marketing purposes

1. In order to better match content and marketing activities to your preferences, the Controller may process your personal data by automated means, including by profiling. Profiling does not produce legal effects concerning you nor similarly significantly affect you.
2. The scope of personal data subject to profiling corresponds to the scope indicated in § 4 with respect to data provided in messages and bookings.
3. The legal basis for the processing is Art. 6(1)(f) GDPR (legitimate interest of the Controller in conducting marketing activities tailored to the preferences of recipients).
4. The Controller will process personal data for the purpose of profiling until an objection is effectively raised or the purpose of processing is achieved.

§ 6

Recipients of personal data

Entities cooperating with the Controller (processors)

1. VPS hosting - provider: mikr.us – UW-TEAM.org Jakub Mrugalski, Tax ID: 6821639338 (CEIDG); country: Poland. Scope: maintenance of the VPS on which the Website runs and the newsletter subscriber list is stored. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller - delivery of the Website).
2. Cloudflare - provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; country: USA (transfer based on Commission Implementing Decision (EU) 2023/1795 - EU-US Data Privacy Framework). Scope: CDN, DDoS protection and optimization of the delivery of the Website to end users. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller - security and performance of the Website).
3. Google Calendar Appointment Scheduling - provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; country: USA / EEA (transfer to the USA based on Commission Implementing Decision (EU) 2023/1795 - EU-US Data Privacy Framework). Scope: handling meeting bookings via the Google Calendar booking page linked from the Website, including accepting bookings and sending confirmations. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into an agreement) and Art. 6(1)(f) GDPR (legitimate interest - enabling contact with the Controller).
4. Fireflies.ai - provider: Fireflies AI, Inc., 333 Bush St, Suite 2300, San Francisco, CA 94104, USA; country: USA (transfer based on Commission Implementing Decision (EU) 2023/1795 - EU-US Data Privacy Framework; where the recipient does not participate in the framework, EU standard contractual clauses). Scope: recording and transcription of meetings scheduled via the Google Calendar booking page (Google Meet) only, for the purpose of producing notes, transcripts and summaries of the consultation; the Fireflies bot joins the meeting after it starts and the Controller informs participants of the recording and obtains their consent at the beginning of the meeting. Ad-hoc meetings and phone calls are not recorded. Legal basis: Art. 6(1)(a) GDPR (participant's consent given at the beginning of the meeting to recording and transcription) and Art. 6(1)(f) GDPR (legitimate interest of the Controller in documenting consultation outcomes, after consent to recording has been obtained).
5. Resend - provider: Plus Five Five, Inc. (operator of the Resend service); country: USA (transfer based on Commission Implementing Decision (EU) 2023/1795 - EU-US Data Privacy Framework; where the recipient does not participate in the framework, EU standard contractual clauses). Scope: sending e-mail messages: subscription confirmations and the newsletter. Legal basis: Art. 6(1)(a) GDPR (consent to receive the newsletter).

Other recipients

1. Personal data may be transferred to public or private entities where such an obligation arises from generally applicable provisions of law, a final court judgment or a final administrative decision (e.g. to tax authorities, courts, law-enforcement bodies).
2. Personal data may be transferred to the accounting firm servicing the Controller and to the law firm servicing the Controller - only to the extent and for the period necessary to fulfill the relevant obligations or perform services for the Controller.

§ 7

Transfer of personal data to third countries

1. In connection with the use of services provided by Google LLC, Cloudflare, Inc., Fireflies AI, Inc. and Plus Five Five, Inc. (Resend), your personal data may be transferred to the United States of America.
2. The basis for the transfer of data to the USA is Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, provided that the relevant recipient participates in that framework.
3. In cases where the recipient does not participate in the EU-US Data Privacy Framework, data is transferred on the basis of standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.
4. You may obtain a copy of the data transferred to a third country from the Controller by contacting [email protected].

§ 8

Your rights

1. Right of access - you may obtain from the Controller information as to whether and which personal data concerning you are being processed and receive a copy of such data. The first copy is provided free of charge; for further copies the Controller may charge a reasonable fee corresponding to administrative costs.
2. Right to rectification - if your data is outdated, incomplete or otherwise incorrect, you have the right to request its rectification or completion.
3. Right to erasure ("right to be forgotten") - in the situations indicated in Article 17 of the GDPR, in particular where the data is no longer necessary for the purposes for which it was collected, you withdraw consent on which the processing is based, or the processing is unlawful.
4. Right to restriction of processing - you may request that the Controller perform no operations on your data other than storing it, in the situations indicated in Article 18 of the GDPR.
5. Right to data portability - with respect to data processed on the basis of consent or contract, you may receive such data in a structured, commonly used, machine-readable format and transfer it to another controller.
6. Right to object - with respect to data processed on the basis of the legitimate interest of the Controller, including profiling. Upon effective objection, the Controller will cease processing the data for the relevant purpose.
7. Right to withdraw consent - at any time, with respect to data processed on the basis of consent. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
8. Right to lodge a complaint with the supervisory authority - the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland), if you consider that the processing of your personal data infringes the GDPR.
9. To exercise the rights above, please contact the Controller at [email protected].

§ 9

Cookies and browser storage

General information

1. The Website uses cookies - small text files stored on your end device - and the local storage and session storage of the browser (localStorage and sessionStorage). Cookies may be read by the Controller's systems as well as by the systems of Cloudflare.
2. The Website does not use analytics or marketing cookies, therefore it does not display a cookie consent panel.
3. Cookies strictly necessary for the operation of the Website (Cloudflare security cookies) and the record of the language version and color theme you selected and of the scroll position of the page are stored without the need to obtain consent, as they are a condition for providing the information-society service requested by the user.
4. Data collected via cookies does not by itself allow the Controller to identify you directly.

List of cookies and browser storage entries used

1. Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) - necessary security cookies (e.g. __cf_bm, cf_clearance) preventing abuse and automated bots. Retention: from 30 minutes to approx. 1 year depending on the cookie type. Status: necessary for the operation of the Website - no consent required.
2. siteLang (Controller) - a cookie with the language version of the Website you selected (pl or en). The Website stores it when you click the language switcher. Retention: 1 year. Status: necessary for the operation of the Website - no consent required.
3. theme (Controller) - an entry in the local storage of the browser (localStorage) with the color theme you selected (light or dark). The Website stores it when you click the theme switcher. Retention: until you delete the data in the browser settings. Status: necessary for the operation of the Website - no consent required.
4. scrollPosition (Controller) - an entry in the session storage of the browser (sessionStorage) with the scroll position of the page. The Website may store it when you go to another subpage of the Website, and it deletes it after it restores that position on the new subpage. Retention: until you close the browser tab at the latest. Status: necessary for the operation of the Website - no consent required.

Browser-side control

1. You may at any time check, delete or block cookies and browser storage data through the settings of your web browser. Disabling cookies may cause limitations in using the Website, in particular the Website will not remember the selected language version.

§ 10

Final provisions

1. In matters not regulated by the Policy, the generally applicable provisions on the protection of personal data shall apply, in particular the GDPR and the Polish Act of 10 May 2018 on the protection of personal data.
2. The Controller may amend the Policy for important reasons, in particular in the event of changes in law, changes in the scope of data processed, changes in the recipients of data or the launch of new functionalities of the Website.
3. The current version of the Policy is published on the Website at https://demystifai.blog/en/privacy and is effective as of the date of its publication, unless a later effective date is indicated.
4. This Policy is effective from: November 9, 2026.